The Agent Evidence Pack for a Security Review
The two documents an enterprise reviewer wants for your AI agent — the allow-list and the tool-call log — specified field by field, generated from code.
Writing · Tag
Posts tagged founders
27 posts on founders. Or browse the full writing index →
Posts tagged founders
Most Security Controls Assume a Team You Don't Have
Security checklists only ever grow, because nobody who writes them pays the cost of a control a small team cannot staff. Which to defer, and which never wait.
Nobody Got Replaced. Agents Got Added.
McKinsey didn't swap 25,000 people for AI agents. What its CEO actually said is more useful to founders — and changes the question to ask before hiring.
What I Check When I Inherit a Vibe-Coded App
The consultant's playbook for taking over an undocumented AI-built app after the builder walks away — what to audit first, and how to price it.
The Schlep Is the Only Moat Agents Can't Cross
Paul Graham's schlep blindness in 2026: agents made the fun half of your product free to copy, so the tedious half is the only part left worth owning.
What Four Months of Embedded AI Engineering Ships
What a sixteen-week embedded AI engineering rotation ships, month by month, from the first merge to the handoff artifacts that let it end.
Detection Got Cheap. Remediation Didn't.
Microsoft just made vulnerability detection cheaper and more accurate. For a 12-40 person AI startup, that was never the bottleneck.
What Reverse Acqui-Hires Actually Diligence
What a buyer's technical reviewer checks in a reverse acqui-hire when the code isn't the asset: key-person risk, IP scope, and contribution forensics.
Why We'd Pick Elixir for an AI Startup Backend
A founder-readable case for Elixir as an AI startup's backend — what the BEAM gets right for agents, streaming, and durable jobs, and when to skip it.
Shadow AI at a Startup That Can't Buy a CASB
The enterprise shadow-AI playbook assumes a CASB budget you don't have. Here's the free, no-blame version for a 5-15 person team: three steps, zero procurement.
What Cyber Insurance Underwriters Ask AI Startups
The cyber insurance application is a security audit in disguise. What underwriters check in 2026, the AI exclusions creeping in, and when coverage is real.
Why Auto-Filled Security Questionnaires Kill AI Deals
Why auto-filling an enterprise security questionnaire backfires on an AI startup — the answers that kill deals, and the questions your SOC 2 won't cover.
Surviving Technical Due Diligence as an AI Founder
What the investor's technical reviewer opens first, the AI-specific flags that re-price rounds in 2026, and the gaps you should deliberately leave alone.
Amazon Let the AI Drive. It Hit a Tree.
Amazon mandated AI coding, let it touch infrastructure unwatched, and lost millions of orders. The fix wasn't less AI — it was more humans per deploy.
AI Made Tokens Cheap. It's Making Hardware Costly.
Apple raised prices on Mac, iPad, and HomePod, blaming an AI-driven memory shortage. The cost of intelligence is falling; the hardware to run it isn't.
The Perfect Hire Is Killing Your Team
The whiteboard coding interview rewards memorization and pedigree — the weakest predictors of real performance. Hire for trajectory, not the perfect match.
Nadella Is Right About AI and the Firm. Mostly.
Satya Nadella's 'token capital' framing is right that AI amplifies human judgment — but it's enterprise advice that skips the small teams who feel it first.
Prove the Return or Don't Spend the Time
Time is the only budget you can't refill, so every dollar and hour has to show a demonstrable return. The most common way businesses break that rule is buying software nobody asked for.
What 90 Days of a Fractional Security Engagement Actually Looks Like
Most founders who book the intro call have already read three or four of my posts and arrive at the same question: "Okay, but what would the next 90 days actually look like if I hired you?" Here's the answer — week by week, with the real numbers.
An AI Just Deleted a Production Database in Nine Seconds. Hire More Engineers.
Replit's AI agent ignored a code freeze, wiped a production database in nine seconds, then confessed it violated every principle it was given. The strongest case yet for hiring MORE senior engineers in the AI boom — not fewer.
AI Won't Shrink Your Team — It'll Expose Why You Needed a Bigger One
Every company rolling out AI is about to discover how much work they were leaving on the table. AI doesn't replace headcount — it surfaces the backlog you never had bandwidth to touch. The math behind why velocity creates surface area, the failure mode that follows, and why the companies cutting headcount now are about to get outpaced.
SOC 2 Is a Revenue Tool, Not a Security Tool
Every AI founder pre-Series A scopes their SOC 2 audit like a security project. Six months later they've burned their best engineer and lost the enterprise deal. Here's how to run it as a 90-day sales project — and unlock the pipeline you're already leaving on the table.
How I'd Run Security at an AI-Native Company in 2026
AI-native companies need a security model that classic appsec doesn't cover. Agents have credentials. Prompts are an attack surface. Training data leaks. The four-layer security stack I'd build, the controls I'd ship in the first 90 days, and the ones I'd defer.
vCISO Math for AI Founders: Why 5 Hours a Month Beats a Full-Time Hire
A full-time CISO costs $200–400K plus equity. A vCISO costs $2–4K a month and gives you 80% of the value at 5% of the burn — until you outgrow them. The math, the deliverables to expect, and the red flags that mean you've hired the wrong one.
From One Engineer to Fifteen: What Co-Founding Taught Me About Engineering Leadership
I went from sole engineer to running a 15-person engineering organization over four years at a startup I co-founded. The hardest lessons weren't about code. The six things I'd tell my younger self.
The Pre-Series-A AI Startup Hiring Plan: Who to Hire, in What Order, and Why Most Get It Wrong
Most pre-Series-A AI founders hire in panic order, not strategic order. The result is a team that can't ship the product the company actually needs. The hire-by-hire plan I'd run, who comes first, and why hire #4 isn't another engineer.
How to Manage a 4-Person Engineering Team Without Becoming a Manager
A 4-person engineering team is the most overlooked unit of management in startups. Big enough that the lead can't write all the code. Small enough that hiring an EM kills velocity. Five rituals that work at this size, three traps to avoid, and the signal that tells you it's time to evolve.